Merge branch master into bees

endpoints/api/__init__.py

@@ -1,8 +1,9 @@
 import logging
 import json
+import datetime
 
 from app import app
-from flask import Blueprint, request, make_response, jsonify
+from flask import Blueprint, request, make_response, jsonify, session
 from flask.ext.restful import Resource, abort, Api, reqparse
 from flask.ext.restful.utils.cors import crossdomain
 from werkzeug.exceptions import HTTPException
@@ -53,11 +54,6 @@ class InvalidRequest(ApiException):
     ApiException.__init__(self, 'invalid_request', 400, error_description, payload)
 
 
-class InvalidResponse(ApiException):
-  def __init__(self, error_description, payload=None):
-    ApiException.__init__(self, 'invalid_response', 500, error_description, payload)
-
-
 class InvalidToken(ApiException):
   def __init__(self, error_description, payload=None):
     ApiException.__init__(self, 'invalid_token', 401, error_description, payload)
@@ -72,6 +68,11 @@ class Unauthorized(ApiException):
       ApiException.__init__(self, 'insufficient_scope', 403, 'Unauthorized', payload)
 
 
+class FreshLoginRequired(ApiException):
+  def __init__(self, payload=None):
+    ApiException.__init__(self, 'fresh_login_required', 401, "Requires fresh login", payload)
+
+
 class ExceedsLicenseException(ApiException):
   def __init__(self, payload=None):
     ApiException.__init__(self, None, 402, 'Payment Required', payload)
@@ -93,6 +94,14 @@ def handle_api_error(error):
   return response
 
 
+@api_bp.app_errorhandler(model.TooManyLoginAttemptsException)
+@crossdomain(origin='*', headers=['Authorization', 'Content-Type'])
+def handle_too_many_login_attempts(error):
+  response = make_response('Too many login attempts', 429)
+  response.headers['Retry-After'] = int(error.retry_after)
+  return response
+
+
 def resource(*urls, **kwargs):
   def wrapper(api_resource):
     if not api_resource:
@@ -163,7 +172,7 @@ def path_param(name, description):
   def add_param(func):
     if not func:
       return func
-
+      
     if '__api_path_params' not in dir(func):
       func.__api_path_params = {}
     func.__api_path_params[name] = {
@@ -265,6 +274,26 @@ def require_user_permission(permission_class, scope=None):
 
 require_user_read = require_user_permission(UserReadPermission, scopes.READ_USER)
 require_user_admin = require_user_permission(UserAdminPermission, None)
+require_fresh_user_admin = require_user_permission(UserAdminPermission, None)
+
+def require_fresh_login(func):
+  @add_method_metadata('requires_fresh_login', True)
+  @wraps(func)
+  def wrapped(*args, **kwargs):
+    user = get_authenticated_user()
+    if not user:
+      raise Unauthorized()
+
+    logger.debug('Checking fresh login for user %s', user.username)
+
+    last_login = session.get('login_time', datetime.datetime.min)
+    valid_span = datetime.datetime.now() - datetime.timedelta(minutes=10)
+
+    if not user.password_hash or last_login >= valid_span:
+      return func(*args, **kwargs)
+    
+    raise FreshLoginRequired()
+  return wrapped
 
 
 def require_scope(scope_object):
@@ -292,25 +321,6 @@ def validate_json_request(schema_name):
   return wrapper
 
 
-def define_json_response(schema_name):
-  def wrapper(func):
-    @add_method_metadata('response_schema', schema_name)
-    @wraps(func)
-    def wrapped(self, *args, **kwargs):
-      schema = self.schemas[schema_name]
-      try:
-        resp = func(self, *args, **kwargs)
-
-        if app.config['TESTING']:
-          validate(resp, schema)
-
-        return resp
-      except ValidationError as ex:
-        raise InvalidResponse(ex.message)
-    return wrapped
-  return wrapper
-
-
 def request_error(exception=None, **kwargs):
   data = kwargs.copy()
   message = 'Request error.'
@@ -338,6 +348,25 @@ def log_action(kind, user_or_orgname, metadata=None, repo=None):
                    metadata=metadata, repository=repo)
 
 
+def define_json_response(schema_name):
+  def wrapper(func):
+    @add_method_metadata('response_schema', schema_name)
+    @wraps(func)
+    def wrapped(self, *args, **kwargs):
+      schema = self.schemas[schema_name]
+      resp = func(self, *args, **kwargs)
+
+      if app.config['TESTING']:
+        try:
+          validate(resp, schema)
+        except ValidationError as ex:
+          raise InvalidResponse(ex.message)
+
+      return resp
+    return wrapped
+  return wrapper
+
+
 import endpoints.api.billing
 import endpoints.api.build
 import endpoints.api.discovery